Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-1703_x64
  • resource
    win10-20240214-en
  • resource tags

    arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system
  • submitted
    19/02/2024, 16:41

General

  • Target

    https://vww-roblox.com/users/3795469963/profile

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://vww-roblox.com/users/3795469963/profile
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4492
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff90ebd9758,0x7ff90ebd9768,0x7ff90ebd9778
      2⤵
        PID:3160
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1828 --field-trial-handle=1780,i,7917355584745302786,7680048502540875724,131072 /prefetch:8
        2⤵
          PID:5000
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=232 --field-trial-handle=1780,i,7917355584745302786,7680048502540875724,131072 /prefetch:2
          2⤵
            PID:4076
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2104 --field-trial-handle=1780,i,7917355584745302786,7680048502540875724,131072 /prefetch:8
            2⤵
              PID:4912
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1780,i,7917355584745302786,7680048502540875724,131072 /prefetch:1
              2⤵
                PID:4976
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1780,i,7917355584745302786,7680048502540875724,131072 /prefetch:1
                2⤵
                  PID:2664
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3796 --field-trial-handle=1780,i,7917355584745302786,7680048502540875724,131072 /prefetch:1
                  2⤵
                    PID:4484
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4748 --field-trial-handle=1780,i,7917355584745302786,7680048502540875724,131072 /prefetch:1
                    2⤵
                      PID:1964
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4596 --field-trial-handle=1780,i,7917355584745302786,7680048502540875724,131072 /prefetch:1
                      2⤵
                        PID:508
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 --field-trial-handle=1780,i,7917355584745302786,7680048502540875724,131072 /prefetch:8
                        2⤵
                          PID:3552
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 --field-trial-handle=1780,i,7917355584745302786,7680048502540875724,131072 /prefetch:8
                          2⤵
                            PID:5016
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5564 --field-trial-handle=1780,i,7917355584745302786,7680048502540875724,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4224
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:4024

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0a28e414-a85f-46ad-9d2d-56c429c91439.tmp

                            Filesize

                            6KB

                            MD5

                            98013875ab2621c2c546703f3d78fcd4

                            SHA1

                            4bda872dd33f7b7b9d3485d947f91917668d1e05

                            SHA256

                            c3246d954efc75ca938832291b5cd263254bbe78aa964cfdd64d4fe8985d16ab

                            SHA512

                            5823a835af52735acf36917bf76dfd38e528bcf7e15010d528695618690674b6eb00371fcb8962c690e90ff3917327671d330f511d3cfacfe21a10146a5ff3c1

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            2KB

                            MD5

                            65a9a837d150ae7bd89e613fbac293fc

                            SHA1

                            bfd5c98aa9b6e14303690215b8586b353ee042c9

                            SHA256

                            0a8b705ab30208934b79150b6d6055b81132a26e7c999745208cbac6e7333a6a

                            SHA512

                            79cb1a24dad0c0f8287ba346bb8e1b35de9101d563b56fef3697d3fdb8556d046403f25b2d64bdfa5bbc5b11943c60d9c36457cb0e57048199551069dc12f813

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8318ef21-e8d6-49c6-a627-eb406987fb5f.tmp

                            Filesize

                            1KB

                            MD5

                            68d48fd87d1074e389db5db01a26c1a8

                            SHA1

                            fad3d4a76b96ad9de996c7b541d0d819b5eec156

                            SHA256

                            3fe4361608e6e37e1629d58349421758c82185a930ed19e3cb97d50c1fa293bc

                            SHA512

                            141c33fbf486337f526624e76e581647f2c59a008429c47436ff1a9d5cee56b4651a305d25c52ddfc88995e7435ede4288321d4d3b962348c6675787e576bb5f

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            5KB

                            MD5

                            51b5c4d24cffaba70818311a8d3c2193

                            SHA1

                            0e60ea9f3ce0ffab16f38bc5b07fcaa4db724344

                            SHA256

                            33a40b1db2f62e06fe2f226072fd3856498982945d58224e70b52f04cbfb3656

                            SHA512

                            ace21da2078fe88b2486470bc75af824a945d741cc9936eaaec56255296dc9228f4a31d1b58acced276858848dc1fda861291b2a597f86076dd05cde83dfb72f

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            7fea10d0959a6ef542315518b9312cfc

                            SHA1

                            f2f8afd5be700ca02cf3465eec9923b72bbb1e63

                            SHA256

                            51f57b7d18e3b00cecd2a25aa558d50ef300f9e3548d42057879e0df66bdc6e2

                            SHA512

                            0a99f8aa22cb401f6d768f292a4caf2289ab59126b28a8012c436fa48aba31ce3081411515fc3065f4175c4a981d9a3454ac8ab127d9853a2ce861c3545d2a16

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            c01f1e31a4d573e8fda8d065cd72af59

                            SHA1

                            cefdc5931a1a5c3c346596926db3610a3de24bff

                            SHA256

                            39f6776aac73b14c2b0be02909500fd21bc641fb892f86db74342d3acf0f35a8

                            SHA512

                            7f7ad04f4be18ef369e4c5fd96f09d7e0137c272c3f906a36fbacff1b92aca7dc9be8c282448038c852cb4f2c0bc92c1ceaedbda0b8eff566cce5d33ac1bbce1

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            1196398be025fc059d30697592ee78f2

                            SHA1

                            f028dfee7d037ebabebc691dc834a653a939548b

                            SHA256

                            564028d0fa4dd0d4aa5d76cda75b95c0652eef1b8bfe6cf47c8f6407c8df4223

                            SHA512

                            7883dc26137aec249cb3ca59156141d290fcd7b0fc056e66d56df42141e12fb113d670f267d1f5caa06f42dd58d1e801b131125a1e8f7b04b6bd60bc4526c164

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            ebb87c1b763dac3cd0be12aeb57644b6

                            SHA1

                            842ae6e48acec8eb955328c3a1e64320c96406fb

                            SHA256

                            9c89f2ef4aa390597ac7572449d2784346d9fb1645549a6bbc1daebd21ecb0e2

                            SHA512

                            d1a41004babe416ec6540623f8b12dad518e06b9824ef4cc9a5141d0d2fe9adb11b092cc05746e0e984f4334860eadd5e0b4e0d8c83d0a68d8c5a79081fedcdd

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            126387b98aa07038eba6feda92f6cf3d

                            SHA1

                            83a09bc26670f322090d93fa0254028481a8457b

                            SHA256

                            399e49a1d48dab39e8a6646b1f502ffcabbe64bec7f0ba36a50298e55740cac5

                            SHA512

                            feaba89ab472680f089714c43053a6dbbea7fda0ac43ee2f0e9291c08e9c384c34ad752b31478bce28724e2c175f6c7f137a8b204732d1efb82256d1dfa38ce2

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            129KB

                            MD5

                            73f46c188ad00d0750f226a170f7f600

                            SHA1

                            2cddd78548e5d8bf3a2f176bf4f6c2879e95b4d8

                            SHA256

                            f6eb2ff1c69df2ce6622b1160a747b5bdb3ef4fef73bf8c81e5d244e0bdd218e

                            SHA512

                            8ae64193440740a96687c783f6d43e4bdbf25affe51bcfe07f964fcb3e5f69c0375e40d9b0d7726b2815c4fb0d124b032e6b69dfb277dd0a9a2d9afeeb34c63a

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd